Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
19-12-2024 19:31
General
-
Target
03fa00884cf73c17010e554ad52bc98e56e57b176a11e524bd98a8af6fb8c9d8.dll
-
Size
796KB
-
MD5
2f586014e2b096df6dfdd8015e326a3d
-
SHA1
6b37190de9e2cf9f5be9c54c49550799fc1d2651
-
SHA256
03fa00884cf73c17010e554ad52bc98e56e57b176a11e524bd98a8af6fb8c9d8
-
SHA512
5131ddf71a528ae982426f660776c742db9b85a9c955c496425b1d86fc12f3886563f9f537f3bc2ad02448772f288a2ed37d46ac68f4af9ed092de78c069c3ad
-
SSDEEP
12288:RBHgxzPkHLCZmx0Kvf27MV5SlZvuAYr42Xq0:RB8sHwEf27Mn5br42Xd
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\03fa00884cf73c17010e554ad52bc98e56e57b176a11e524bd98a8af6fb8c9d8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\rWp6E\VaultSysUi.exeC:\Users\Admin\AppData\Local\rWp6E\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\Uhz9l\FXSCOVER.exeC:\Users\Admin\AppData\Local\Uhz9l\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\ImKMOAGf\DWWIN.EXEC:\Users\Admin\AppData\Local\ImKMOAGf\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
796KB
MD589ffeffee659f9f808bdb61ffca5d361
SHA11fc3331fb77eb220249967fe02179a252d448a01
SHA25685e9db8e896bd068b1891ad48bf5db201624674760e4b9b6d46c51601bea4e4d
SHA5120e772db03046edf72f4781168cda6a54720ebb89c354308f7e23b3d5cc352d838773d78d26c6cfb33839c16bb9a4494d6c12ef21d2721f54a761dd970b3e5f13
-
Filesize
824KB
MD592fd84e80634bf2bebe540f52348120f
SHA1c1a288d0fc13a02acafe8a82733b8ac971ef7788
SHA2561abf509d16a8f48ac7d4abeeae4caba6034ad8f90b2d214cfc3d6e3dc6a22323
SHA512f8affad6a18ea20c3ef9239b344483f836cae3f885268073da0165f8b78d77f219e65b6490e9e39c46beb9983538c7f9d65a73bb1bc918f2b814c962b1930487
-
Filesize
800KB
MD52dd91a322d478a94b63701b78d4bb8f4
SHA1f22e69ea84cd9983c8397da6e6b2bee82bf094c6
SHA2560ad534dfa2534036d50963cd0b4c09e3e247cba6ca7edcf404075ab2f1cba60d
SHA5122441086b6f980259fface79cf170ff42b80a4e0816963e035274f695ebb12245026022f4faf7a6f412849a667e24d392af1ed4ae50900f14146e98a2438e12cc
-
Filesize
1KB
MD5cd31dc8d990dd66697da361852611149
SHA1169d443cda81b520b0b151a4d8602e0c72b61da6
SHA256383abc957bcbcc3975843088af1a03de9890c1aade58cb1b50f03eadb92ab017
SHA512a154895a8fff4619eecded8a1b75ede7c3c1f5d9b95452d1ef7861cbdb0a6635a01093cc8bd1e4f1df41f29f88b06e28652a512146b5a119e1059b0aa0f22b8f
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB